Fedora 8 : trac-0.10.5-1.fc8 (2008-6830)

Update to 0.10.5 to fix two non-critical security issues: CVE-2008-2951: Open redirect vulnerability in the search script in Trac before 0.10.5 allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via a URL in the q parameter. CVE-2008-3328: Cross-site...

RHEL 4 : kernel (RHSA-2008:0665)

Updated kernel packages are now available as part of ongoing support and maintenance of Red Hat Enterprise Linux 4. This is the seventh regular update. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel...

Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : php5 vulnerabilities (USN-628-1)

It was discovered that PHP did not properly check the length of the string parameter to the fnmatch function. An attacker could cause a denial of service in the PHP interpreter if a script passed untrusted input to the fnmatch function. CVE-2007-4782 Maksymilian Arciemowicz discovered a flaw in t...

USN-628-1: PHP vulnerabilities

It was discovered that PHP did not properly check the length of the string parameter to the fnmatch function. An attacker could cause a denial of service in the PHP interpreter if a script passed untrusted input to the fnmatch function. CVE-2007-4782 Maksymilian Arciemowicz discovered a flaw in t...

Fedora 8 : phpMyAdmin-2.11.7.1-1.fc8 (2008-6450)

"This update solves a not yet clearly documented security issue with phpMyAdmin. - interface New field cannot be auto-increment and primary key - dbi Incorrect interpretation for some mysqli field flags - display part 1: do not display a TEXT utf8bin as BLOB fixed for mysqli extension only -...

Fedora 9 : phpMyAdmin-2.11.7.1-1.fc9 (2008-6502)

"This update solves a not yet clearly documented security issue with phpMyAdmin. - interface New field cannot be auto-increment and primary key - dbi Incorrect interpretation for some mysqli field flags - display part 1: do not display a TEXT utf8bin as BLOB fixed for mysqli extension only -...

php crash in glob() and fnmatch() functions

PHP before 5.2.3 allows context-dependent attackers to cause a denial of service application crash via 1 a long string in the pattern parameter to the glob function; or 2 a long string in the string parameter to the fnmatch function, accompanied by a pattern parameter value with undefined...

php crash in glob() and fnmatch() functions

PHP before 5.2.3 allows context-dependent attackers to cause a denial of service application crash via 1 a long string in the pattern parameter to the glob function; or 2 a long string in the string parameter to the fnmatch function, accompanied by a pattern parameter value with undefined...

php crash in glob() and fnmatch() functions

PHP before 5.2.3 allows context-dependent attackers to cause a denial of service application crash via 1 a long string in the pattern parameter to the glob function; or 2 a long string in the string parameter to the fnmatch function, accompanied by a pattern parameter value with undefined...

nBill component for Joomla! 'cid' Parameter SQLi

The version of the nBill also known as netinvoice component for Joomla! and Mambo running on the remote host is affected by a SQL injection vulnerability due to improper sanitization of user-supplied input to the 'cid' parameter before using it to construct database queries. Regardless of the PHP...

Trac quickjump Search Script q Parameter Arbitrary Site Redirect

The remote host is running Trac, an enhanced wiki and issue tracking system for software development projects. The version of Trac installed on the remote host fails to sanitize user input to the 'q' parameter of the 'search' script before using it in an unfiltered and unmanaged fashion in a...

commtouch-xss.txt

Commtouch Anti-Spam Enterprise Gateway Cross Site Scripting allowing domain credential theft I. INTRODUCTION Commtouch Anti-Spam Enterprise Gateway is an anti spam solution, protecting enterprise networks for the ever increasing spam emails. The anti spam solution includes a web application conso...

Fedora 9 : phpMyAdmin-2.11.7-1.fc9 (2008-5676)

"This update solves PMASA-2008-4 phpMyAdmin security announcement from 2008-06-23: XSS on plausible insecure PHP installation; see http://www.phpmyadmin.net/homepage/security.php?issue=PMASA-2008-4 - interface New field cannot be auto-increment and primary key - dbi Incorrect interpretation for...

Fedora 8 : phpMyAdmin-2.11.7-1.fc8 (2008-5640)

"This update solves PMASA-2008-4 phpMyAdmin security announcement from 2008-06-23: XSS on plausible insecure PHP installation; see http://www.phpmyadmin.net/homepage/security.php?issue=PMASA-2008-4 - interface New field cannot be auto-increment and primary key - dbi Incorrect interpretation for...

LifeType for Drupal (pLog) index.php albumId Parameter SQL Injection

The remote host is running pLog or Lifetype, an open source blogging platform written in PHP. The remote version of this software fails to sanitize user-supplied input to the 'albumId' parameter of the 'index.php' script before using it in a database query in the 'getAlbum' method in...

AEC Subscription Manager Component for Mambo / Joomla! 'usage' Parameter SQLi

The version of the AEC Subscription Manager component for Joomla! and Mambo running on the remote host is affected by a SQL injection vulnerability in the acctexp.class.php script due to improper sanitization of user-supplied input to the 'usage' parameter before using it to construct database...

Alt-N SecurityGateway username Buffer Overflow

Alt-N SecurityGateway is prone to a buffer overflow condition. This is due to insufficient bounds checking on the "username" parameter. Successful exploitation could result in code execution with SYSTEM level privileges. NOTE: This service doesn't restart, you'll only get one shot. However, it...

RHEL 5 : bind (RHSA-2008:0300)

"Updated bind packages that fix two security issues, several bugs, and add enhancements are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Berkeley Internet Name Domain BIND is an implementatio...

HLDS WebMod 0.48 Multiple Remote Vulnerabilties

No description provided by source. Luigi Auriemma Application: WebMod http://www.djeyl.net/w.php Versions: = 0.48 Platforms: Windows and Linux Bugs: A directory traversal B Cookie buffer-overflow C parser.cpp arbitrary memory writing D scripts source disclosure Exploitation: remote Date: 03 May...

HLDS WebMod 0.48 - Multiple Remote Vulnerabilities

HLDS WebMod 0.48 - Multiple Remote Vulnerabilities Luigi Auriemma Application: WebMod http://www.djeyl.net/w.php Versions: = 0.48 Platforms: Windows and Linux Bugs: A directory traversal B Cookie buffer-overflow C parser.cpp arbitrary memory writing D scripts source disclosure Exploitation: remot...